Aap-gateway: xss on aap-gateway

CVE-2024-10033

6.1MEDIUM

Key Information

Vendor: Red Hat
Status: Red Hat Ansible Automation Platform 2.5 For Rhel 8; Red Hat Ansible Automation Platform 2.5 For Rhel 9
Vendor: CVE Published:; 16 October 2024

Summary

A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.

Affected Version(s)

Red Hat Ansible Automation Platform 2.5 for RHEL 8 <= 0:2.5.3-1.el8ap

Red Hat Ansible Automation Platform 2.5 for RHEL 9 <= 0:2.5.3-1.el9ap

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Timeline

Reported to Red Hat.
Oct 16, 2024
Vulnerability published.
Oct 16, 2024

Collectors

NVD DatabaseMitre Database

Credit

This issue was discovered by Rick Elrod (Red Hat).